HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF …
PERFORMANCE AUDIT OF
HUMAN RESOURCES MANAGEMENT NETWORK (HRMN) SELF-SERVICE
DEPARTMENT OF CIVIL SERVICE July 2004
19-596-03
"...The auditor general shall conduct post audits of financial transactions and accounts of the state and of all branches, departments, offices, boards, commissions, agencies, authorities and institutions of the state established by this constitution or by law, and performance post audits thereof."
? Article IV, Section 53 of the Michigan Constitution
Audit report information may be accessed at:
Michigan
Office of the Auditor General
REPORT SUMMARY
Performance Audit
Human Resources Management Network (HRMN) Self-Service Department of Civil Service (DCS)
Report Number: 19-596-03
Released: July 2004
HRMN Self-Service is the State's Web-based automated system used by State employees and human resource managers to view and maintain personnel information related to employee benefits, leave balances, pay warrant information and withholdings, and life events. HRMN Self-Service also enables human resource managers to track and maintain human resource reports.
Audit Objective: To assess the effectiveness of security over HRMN Self-Service.
Audit Conclusion: DCS did not completely establish effective security over HRMN Self-Service.
Material Conditions: DCS did not sufficiently evaluate and minimize the risk of providing confidential State employee and dependent data over the Internet through HRMN Self-Service. Appropriate evaluation and risk assessment would minimize vulnerabilities to the State and to State employees resulting from unauthorized access. (Finding 1)
DCS did not completely establish effective access and password controls over HRMN Self-Service. Effective access and password controls minimize the possibility of unauthorized users obtaining access to HRMN Self-Service data. (Finding 2)
DCS had not developed and implemented sufficient Web application security controls. Without the implementation of sufficient Web application security controls, personnel data and Web application resources are vulnerable to intrusion or misuse. (Finding 3)
~~~~~~~~~~
Audit Objective: To assess the effectiveness of general controls over HRMN Self-Service.
Audit Conclusion: The Department of Information Technology's (DIT's) general controls over HRMN Self-Service were reasonably effective.
Reportable Conditions:
DIT had not established controls over the
operating system configuration. The
operating system should be installed with a
minimal service configuration to reduce the
risk of intrusion and the exploitation of
well-known
operating
system
vulnerabilties. (Finding 4)
DIT had not established complete operating system access controls. This could result in unauthorized modification, loss, or disclosure of confidential State employee data. (Finding 5)
DIT had not established complete physical security controls over HRMN Self-Service resources. Physical security controls help ensure that valuable system resources are safeguarded and that access is limited to individuals responsible for managing the system. (Finding 6)
DIT should strengthen controls over program changes to HRMN Self-Service. Program change controls help ensure that only authorized, tested, and approved program modifications are implemented and that access to and distribution of programs are carefully controlled. (Finding 7)
~~~~~~~~~~
Agency Response: Our audit report contains 7 findings and 7 corresponding recommendations. The agency preliminary response indicated that DCS and DIT agreed with the 3 recommendations and 4 findings, respectively, pertaining to their operations.
~~~~~~~~~~
A copy of the full report can be obtained by calling 517.334.8050
or by visiting our Web site at:
Michigan Office of the Auditor General 201 N. Washington Square Lansing, Michigan 48913
Thomas H. McTavish, C.P.A. Auditor General
Scott M. Strong, C.P.A., C.I.A. Deputy Auditor General
STATE OF MICHIGAN
OFFICE OF THE AUDITOR GENERAL
201 N. WASHINGTON SQUARE LANSING, MICHIGAN 48913
(517) 334-8050 FAX (517) 334-8079
THOMAS H. MCTAVISH, C.P.A. AUDITOR GENERAL
July 27, 2004
Ms. Susan Grimes Munsell, Chairperson Civil Service Commission and Ms. Janet M. McClelland, Acting State Personnel Director Department of Civil Service Capitol Commons Center Lansing, Michigan and Ms. Teresa M. Takai, Director Department of Information Technology Landmark Building Lansing, Michigan
Dear Ms. Munsell, Ms. McClelland, and Ms. Takai:
This is our report on the performance audit of Human Resources Management Network (HRMN) Self-Service, Department of Civil Service.
This report contains our report summary; description of system; audit objectives, scope, and methodology and agency responses; comments, findings, recommendations, and agency preliminary responses; and a glossary of acronyms and terms.
Our comments, findings, and recommendations are organized by audit objective. The agency preliminary responses were taken from the agencies' responses subsequent to our audit fieldwork. The Michigan Compiled Laws and administrative procedures require that the audited agency develop a formal response within 60 days after release of the audit report.
We appreciate the courtesy and cooperation extended to us during the audit.
AUDITOR GENERAL
19-596-03
................
................
In order to avoid copyright disputes, this page is only a partial summary.
To fulfill the demand for quickly locating and searching documents.
It is intelligent file search solution for home and business.
Related download
- human resources technician state of michigan
- human resources analyst state of michigan
- human resources michigan state university
- office of human resources home michigan office of
- human resources developer state of michigan
- human resources developer
- office of human resources home michigan office of the
- theodore h curry ii associate provost and associate vice
- human resources analyst
- state of michigan department of human services
Related searches
- starbucks human resources jobs
- sample human resources performance review
- starbucks human resources practices
- nyc doe human resources department
- meridian human resources wall nj
- starbucks human resources contact
- starbucks human resources phone number
- starbucks human resources strategy
- nyc doe human resources ess
- florida hospital human resources online
- human resources meridian health nj
- human resources management textbook pdf